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(57) Abstract: An engine shutdown system 
is provided that includes an engine control 
module (ECM) (12) having sensors (20, 22, 
24, 26, 28, 30, 34, 36) that can activate an 
engine shutdown sequence. A set of redundant 
sensors (20*, 22\ 24', 26% 28\ 30\ 32% 34% 
36') and a redundant engine control module 
(RECM) (14) can also activate an engine 
shutdown sequence independent of the ECM. 
Engine operating parameters are monitored 
by sensors to determine if one of the engine 
parameters deviates from an acceptable 
level. If the engine control determines that a 
parameter has exceeded a predetermined level, 
an engine shutdown signal may be generated 
by either the ECM or RECM that may cut off 
the fuel supply, interrupt an ignition circuit, or 
activate external engine shutdown devices and 
may also activate alarm and message panels. 
A redundant engine shutdown system is also 
provided to disable the primary engine control 
unit. 
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